[sr-dev] git:master:f39f7320: tm: use snprintf() instead of sprintf()

Module: kamailio Branch: master Commit: f39f73204d53312612ef2c3d3cec9c2fd51532c7 URL: https://github.com/kamailio/kamailio/commit/f39f73204d53312612ef2c3d3cec9c2… Author: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Committer: Daniel-Constantin Mierla &lt;miconda(a)gmail.com&gt; Date: 2019-11-25T11:54:36+01:00 tm: use snprintf() instead of sprintf() --- Modified: src/modules/tm/tm.c --- Diff: https://github.com/kamailio/kamailio/commit/f39f73204d53312612ef2c3d3cec9c2… Patch: https://github.com/kamailio/kamailio/commit/f39f73204d53312612ef2c3d3cec9c2… --- diff --git a/src/modules/tm/tm.c b/src/modules/tm/tm.c index 6cbdaf1776..ba6fc82c74 100644 --- a/src/modules/tm/tm.c +++ b/src/modules/tm/tm.c @@ -538,21 +538,27 @@ static int fixup_on_failure(void** param, int param_no) static int fixup_on_branch_failure(void** param, int param_no) { char *full_route_name = NULL; - int len; + int blen =0; + int bsize = 0; int ret = 0; - if (param_no==1){ - if((len = strlen((char*)*param))<=1 - && (*(char*)(*param)==0 || *(char*)(*param)=='0')) { + if (param_no==1) { + bsize = strlen((char*)*param); + if((bsize <=1) && (*(char*)(*param)==0 || *(char*)(*param)=='0')) { *param = (void*)0; return 0; } - len += strlen(BRANCH_FAILURE_ROUTE_PREFIX) + 1; - if ((full_route_name = pkg_malloc(len+1)) == NULL) - { + bsize += strlen(BRANCH_FAILURE_ROUTE_PREFIX) + 2; + if ((full_route_name = pkg_malloc(bsize)) == NULL) { LM_ERR("No memory left in branch_failure fixup\n"); return -1; } - sprintf(full_route_name, "%s:%s", BRANCH_FAILURE_ROUTE_PREFIX, (char*)*param); + blen = snprintf(full_route_name, bsize, "%s:%s", + BRANCH_FAILURE_ROUTE_PREFIX, (char*)*param); + if(blen<0 || blen>=bsize) { + LM_ERR("Failure to construct route block name\n"); + pkg_free(full_route_name); + return -1; + } *param=(void*)full_route_name; ret = fixup_routes("t_on_branch_failure", &event_rt, param); pkg_free(full_route_name);